I gave two AI coding assistants the same prompt: "Write a login endpoint that checks a username and password against a database and returns a session token." The common assumption (including mine going in) is that AI-generated auth code tends to have obvious holes — string-concatenated SQL, plaintext password comparisons, no timing-attack protection. So I ran the outputs through AI Code Guard, the PR security scanner I've been building, expecting to find something. Both implementations got...